Ana içeriğe geç

Release Notes 2026

Version 2026.09.0​

uyarı

IMPORTANT — Action required if you use the SQL/JDBC traffic-log connector: If your Apinizer installation writes API proxy traffic logs to a relational database (Oracle, MySQL, PostgreSQL, or SQL Server) via the SQL/JDBC traffic-log connector, you must run the log-table update script before or during the upgrade to 2026.09.0. This adds the new AI Gateway, MCP Gateway, A2A Gateway, and routing-diagnostics information to the relevant log table. This step is not required if you use the Elasticsearch or MongoDB traffic-log connector — those already carry the new information automatically. Log Table Update Scripts

uyarı

IMPORTANT — API Portal API Product specification files: API Product OpenAPI/spec management changed in this release. Back up your existing products’ specification files before upgrading:

  • Products created by uploading a specification file directly: Download the specification before the upgrade. After the upgrade, open each product and upload the specification again.
  • Products created by selecting from Apinizer (proxy / catalog): You can download the specification before or after the upgrade; after the upgrade, you still need to open each product and upload the specification again.
not

The main theme of this release is the Apinizer AI Gateway module — bringing LLM-backed services under the same lifecycle, routing, security, and observability model as regular APIs.

FEATURED NEW FEATURES

  • AI Gateway — Manage LLM Services Like Any Other API​

A full AI Gateway module has been added alongside the existing API proxy model: create an "AI" type API proxy that fronts LLM services behind a single OpenAI-compatible endpoint, backed by providers for OpenAI, Azure OpenAI, Gemini, Bedrock, Vertex, DeepSeek, Moonshot, and Ollama (plus any other OpenAI-compatible engine you host yourself), with end-to-end streamed request/response support. See. APNZ-5128

  • Multi-Provider Routing and Automatic Failover​

AI proxies can route across providers by cost or latency, balance traffic across an equal-priority pool of primary connections, and fail over automatically through a configured backup chain when a primary connection errors out or becomes unavailable. See. APNZ-5128

  • AI Guardrail Policies — Prompt, PII, DLP, Topic, and Loop Protection​

A family of AI-specific guardrail policies protects request and response traffic: Prompt Guard detects jailbreak and prompt-injection attempts (evaluated immediately, in the background, or in shadow mode), PII Mask redacts personal data such as national ID numbers, IBANs, and phone numbers in both regular and streamed responses, DLP Guard blocks, flags, or masks matches against configurable secret/sensitive-data patterns, Topic Guard keeps conversations on an approved subject, Context Integrity guards against conversation tampering, and Loop Guard curbs runaway tool-call loops. Guardrail presets can be defined once per project and reused across AI proxies. See. APNZ-5128

  • Semantic Cache for LLM Responses​

AI proxies can cache LLM responses at two layers — an exact-match cache for identical prompts and a meaning-similarity semantic cache for near-duplicate prompts — cutting repeated cost and latency for common questions before a request ever reaches the provider. See. APNZ-5128

  • Token and Cost Budgets with Rate Limiting​

Token and USD budgets can be enforced at project, application, credential, and organization scope, with a reservation against the estimated request cost before the call and a reconciliation against real usage once the response completes. Soft caps warn while still letting traffic through; hard caps reject further requests once a quota is exhausted. See. APNZ-5128

  • Retrieval-Augmented Generation (RAG) and Knowledge Bases​

Knowledge bases can be built from your own documents (PDF upload with splitting and de-duplication) and stored in a vector store of your choice — pgvector, Qdrant, or Redis — using a provider such as Ollama or OpenAI. A RAG injection policy retrieves the relevant passages at request time and grounds the model's response in them, and a knowledge base can be refreshed on demand as its documents change. See. APNZ-5128

  • MCP Gateway — Inbound and Outbound Model Context Protocol​

Apinizer now participates on both sides of MCP (Model Context Protocol): an inbound MCP server exposes any AI proxy as a discoverable, callable tool set for MCP-compatible agents, while an outbound MCP Tool Call policy lets an AI flow call tools on an external MCP server as part of handling a request. See. APNZ-5128

  • A2A Gateway — Inbound and Outbound Agent2Agent Protocol​

Apinizer AI Gateway also supports A2A (Agent2Agent) bidirectionally: inbound, an AI proxy can be published as an A2A agent with an agent card and message/task lifecycle, and outbound, an A2A Agent Call policy lets an AI flow delegate work to an external A2A agent. See. APNZ-5128

  • LLM Providers, Model Catalog, and Credential-Based Access​

LLM provider connections store their API keys as encrypted secrets and can be reused across any number of AI proxies, a model catalog tracks each model's pricing and capabilities for cost tracking and routing decisions, and consumer-facing access is scoped through credentials — so a given application or user can be granted its own model and budget access without touching anyone else's. See. APNZ-5128

  • AI Analytics and Observability​

An Elasticsearch-backed AI analytics layer tracks every AI request with dedicated fields for provider, model, token counts, cost, latency, cache hits, and guardrail hits — including for streamed responses, whose tokens are accounted for once the response completes. Dashboards surface summary indicators and token/cost trends, provider and model share, guardrail and cache-efficiency reports, and usage breakdowns by person, group, organizational unit, application, and model, alongside a live request trace view. See. APNZ-5128

  • AI Assets Manageable Through APIops​

Every AI asset type — LLM provider connections, AI proxies, MCP and A2A gateways, knowledge bases, vector database connections, and budgets — can now be created, updated, and deleted by name through APIOps, the same as regular API proxies and connections. An outbound MCP server or A2A agent is not a separate asset: it is defined together with the gateway routing or the policy that uses it. APNZ-5128

  • Portal Applications in Identity Management with Metadata and AI Budget Scoping​

Portal Applications can now be viewed and managed by admins directly from the Identity Management menu across all projects, with a dedicated read-only view page and Edit/Delete actions, alongside a new encrypted key-value Metadata tab shared with the self-service Portal UI. AI token/cost budgets can now be scoped down to an individual application's credential without breaking existing organization-wide budgets left unset. A follow-up fix also closed a data-sync bug where legacy Portal Applications missing a portal link were invisible from the Portal UI while still showing in Manager. See. APNZ-6419

  • Credential Synchronization​

Users from LDAP/Active Directory, Database, and API identity providers can now be automatically synchronized into Apinizer credential records on a schedule or manual trigger, with sync profile, deactivation mode, status/history monitoring, and conflict handling managed from each provider screen. See. APNZ-6445

  • API Portal Support Tickets​

End users can now open, message on, and track support tickets directly from the API Portal. API Manager gains a matching admin-side ticket inbox — list, detail view, KPI dashboard, custom ticket-number prefixing, and an unassigned-ticket count — with an optional Jira status mapping that can drive the ticket lifecycle (Open, Waiting for Customer, Answered, Resolved). APNZ-6468

  • Renewed API Portal Product, Plan, Catalog, and Application Management​

API Portal management was overhauled end to end: Free / Flat rate / Metered / Tiered plan models on API products, tabbed product management (APIs, plans, visibility, OpenAPI, subscriptions), a provider-facing API Catalog, organization membership/invite/join-request flows, application create–subscribe–prod-promote wizards, and a delete-approval workflow. On the admin side, a cross-organization Traffic & Usage report (Usage / Traffic tabs, Test-Sandbox / Production environment switch) provides up-to-date quota visibility. See., See. APNZ-6470

  • API Portal API Traffic Report​

Portal administrators can now view portal subscription traffic in a tabular report from Portal → Reports → API Traffic Report, broken down by API product, organization, account, and application, with successful, blocked, and error request counts plus min/max/average response times, filterable by date range, API product, organization, and account. APNZ-5200

  • Renewed Export/Import Wizard with Dependencies​

The new Export/Import wizard, available from the project menu, lets you export API Proxies, Proxy Groups, global policies, policy groups, credentials, LLM providers, MCP/A2A connections, knowledge bases, and many other object types together with their dependency tree in a single package; on import, each dependency can be mapped to an existing counterpart in the destination project or created anew. Export/Import actions on asset screens now route directly into the wizard flow, and additional asset types such as Task Flow, Identity Service, Test Collection (folder tree and test records together), Uptime Monitor, Custom Query, and Report Configuration are also supported. Shared dependencies are resolved once, unwanted objects or dependencies can be excluded from the package, and Import as New / Replace Existing modes, Client Route editing for API Proxy/Proxy Group, and optional package encryption (including secret values and object names) are supported. See. APNZ-6411, APNZ-6443, APNZ-6450

  • Gateway Idempotency Setting​

A new Idempotency Setting — configurable like CORS and Cache on API proxies, proxy groups, and Setting Groups — detects duplicate requests. Concurrent duplicates are rejected and completed requests can be replayed from stored responses — reducing double-processing risk from retries or network repeats in payment and open-banking flows. The same setting can also be updated through APIops. See. APNZ-6453

  • DPoP in JOSE Policies​

The JOSE Validation policy now supports sender-constrained access tokens via DPoP proof verification. The JOSE Implementation policy can also generate proofs when Apinizer calls DPoP-protected upstreams as a client — so a stolen token cannot be used without the private key. See., See. APNZ-6473

  • Standard Duplicate, Audit, and Rollback​

Duplicate, Audit, and Rollback are now offered as a shared lifecycle action across API Proxies, policies, connections, credentials, keystores, and many other asset types: clone a record in one click, review change history with a diff view, and restore a previous configuration snapshot when needed. See. APNZ-6309

IMPROVEMENTS

  • Backend Network Sub-Phase Timing Metrics and Routing Diagnostics Panel​

The gateway now measures connection setup, secure-connection establishment, time to first response, and body-read duration for every backend call, recording them alongside existing routing trace information. These step-by-step timings are surfaced in a Routing Diagnostics panel, giving support and operations teams a way to pinpoint where a slow or timed-out backend call actually stalled without an external monitoring tool. See. APNZ-6345

  • Backend Routing Address HTTP Method Override​

Each backend routing address definition can now optionally pin its own HTTP method instead of always forwarding the method the request arrived with. The setting is applied per address — primary, canary, sticky, load-balanced, and failover addresses each use their own value — while mirrored traffic keeps using its own address setting. The gateway also now recognizes the HTTP QUERY method: a client request using QUERY is accepted and forwarded to the backend with its body intact, instead of failing as before. See. APNZ-6430, APNZ-6401

  • Attribution-Enriched Quota Usage Tracking and Alerting​

Quota usage now periodically links credential-plan, API-based quota policy, and Rate Limit Control List values back to their credential, app, product/account, and organization. This information powers both the Quota Usage & Alerts consumption report and configurable quota-threshold email alerts. See. APNZ-6431

  • Key Store, Trust Store, and Key Export/Import​

Key Store and Trust Store definitions (JKS/PFX), plus private/public/secret key definitions, can now be exported and imported the same way certificates already could — as a binary file or a portable JSON export. The same operations were added to APIops and wired into the Manager UI on both the Key Store and Crypto Key screens. See. APNZ-4959

  • API Proxy Deploy Status Query via APIops​

You can now query through APIops whether an API proxy is deployed in a given environment and whether a redeploy is required — for pre- and post-deploy checks in automation workflows. See. APNZ-6349

  • Route Health Check, Invoke Info, and Backend Error Template Setting via APIops​

Through APIops you can verify that a route is being served after deploy, retrieve invoke information (address, path, methods), and read or update the Routing setting for the backend error response template. See., See., See. APNZ-6350, APNZ-6352, APNZ-6343

  • Allowed IP List IP Groups and Query Parameter Encoding via APIops​

Through the APIops Management API, Allowed IP List policies can now bind existing IP Group records in addition to direct IP/CIDR entries, and connection settings let you choose how query parameter values are encoded toward the backend (Standard, Protected, Passthrough) — the same Query Parameter Encoding options as in Manager. See., See., See. APNZ-6377, APNZ-6383

  • Error Information for Scripts on the Error Pipeline​

Script policies on an API Proxy error pipeline can now behave differently based on the error type, message, code, and HTTP status — for example transforming the response on routing failures while leaving policy blocks untouched. See. APNZ-6381

  • Promoting Dependencies in API Promotion​

API Promotion transfers now automatically detect creator dependencies of the source API Proxy or Proxy Group along with global policy and certificate-family records, which must be mapped or newly created in the destination environment — so not only the proxy definition but also the dependencies it needs to run can move together. See. APNZ-6412

  • Renewed Reparse Flow — Selective Field Overwrite​

The API Proxy reparse wizard has been renewed: after re-fetching the source definition (WSDL/OpenAPI, etc.), you can choose which fields — such as routing address, schema, name, and method list — are overwritten, and the import proceeds accordingly. See. APNZ-6444

  • Configurable Scope-Mismatch Behavior for OAuth2/JWT Token Endpoints​

Token issuance for credential-based and proxy-based OAuth2/JWT flows now resolves scope mismatches through a shared, centrally configurable setting instead of always failing when a requested scope is missing. Administrators can choose to issue a token with the intersection of requested and granted scopes instead of rejecting the request outright, closing a prior gap where the proxy-side client-credentials flow performed no scope validation at all. See. APNZ-6232

  • Keystore Studio​

Apinizer Toolbox gained a new "Keystore Studio" tool — a browser-based counterpart to desktop KeyStore Explorer. It opens and inspects common keystore and certificate formats, generates key pairs, imports certificates, and can save the result directly into the Apinizer secret pool. See. APNZ-6308

  • Multi-Value Project Tags with Tag-Based Filtering​

Projects can now be tagged with multiple free-text labels from the project definition screen, and the project selection popup lets users filter the project list by these tags — making it easier to organize and locate projects in organizations with many of them. See. APNZ-4954

  • Optional WS-Addressing Fields in SOAP Method Settings​

The WSA Settings section in SOAP Method Settings no longer requires every WS-Addressing address field to be filled in before saving; these 8 fields are now optional, while the mandatory selects and the top-level SOAP Action remain required. See. APNZ-6247

  • Duplicate-Email Prevention and Password Validation for Organization Manager Portal Accounts​

The Organization Manager Portal account create/edit screen now blocks Save whenever the entered email address already belongs to another account, checked live as the field is edited. The form also enforces password complexity — minimum/maximum length and a mix of uppercase and lowercase characters. APNZ-5941

  • Performance Improvements for Log Connectors​

Performance improvements were made for log writing through the Webhook, Syslog, Kafka, RabbitMQ, and Database connectors. APNZ-6482, APNZ-6483

  • Retry on Error for API Call and JOSE Policies​

The API Call policy and the dynamic-key calls in JOSE Validation and JOSE Implementation can now apply configurable retries when an error occurs; attempt count, backoff strategy, and limits for connection failures and selected HTTP status codes are managed from the policy screen. See., See., See. APNZ-6492

  • PDF Upload and Published-File Deletion on API Product Files​

The API Product Files tab in the API Portal now supports uploading PDF files, and deleting files from published products works correctly. See. APNZ-6502

  • API Product and Portal Setting Export/Import​

API Product and Portal Setting definitions can now be exported and imported through the Export/Import wizard, so portal products and portal settings can be included in the same packaging flow as other assets. See., See., See. APNZ-6497

  • HTTP/2 Support in API Routing​

HTTP/2 support was added to API routing. See. APNZ-6507

  • RLCL APIops GET and LIST Endpoints​

RLCL (Rate Limit Control List) definitions can now be read one by one and listed by project through APIops. See., See. APNZ-6516

BUG FIXES

  • Fixed Rejected Requests Being Counted Against Quota and Throttling Limits​

In Quota and Throttling policies, requests that hit the limit and were rejected could still inflate the usage counter, so raising the limit later did not restore the expected remaining allowance. Whether rejected requests are counted and how the counter behaves when the limit changes can now be configured. See., See. APNZ-2452

  • Fixed Allowed IP List Policies Disappearing After Upgrade​

When upgrading from 2025.11.0 to 2026.04.x, Allowed IP List policies attached to an API Proxy could disappear. Policies added directly on the proxy are now preserved. See. APNZ-6494

  • Fixed Forgot-Password Emails Using the Wrong Portal Settings in Multi-Portal Environments​

In environments with multiple API Portals, the Forgot Password flow could use another portal's email and link settings instead of the portal where the request was made, so reset and sign-in links could open the wrong portal. Each portal now uses its own settings. See., See. APNZ-6409

  • Fixed Worker Pod Restarts Under High Token/Audit Load​

Under heavy token-endpoint traffic, token and audit log writing could overload workers and cause pods to restart. Log writing and error logging were improved so they no longer stall under this load. See. APNZ-6501

  • Added Email Filtering on the Credential List​

You could not filter the credential list by email when several API keys shared the same address across different applications. Email-based filtering is now available. See. APNZ-6500

  • Fixed Cache Policy Conditions Not Persisting After Save​

Conditions defined on the Cache policy were not saved and disappeared when the policy was reopened. Conditions are now persisted. The same issue was fixed on related AI policies that use a Conditions tab. See. APNZ-6504

  • Fixed API Call Policy Sending Accept-Encoding Unintentionally​

The API Call policy could send an Accept-Encoding header even when it was not configured on the Header tab. Compression is now off by default and can be enabled from Settings if needed. See. APNZ-6513

  • Fixed Accidental Undeploy When Update API Proxy Deployment Fails​

When updating a proxy via the Management API with an invalid environment, an error was returned but the proxy was still undeployed. When deployment fails, the previous deploy state is now preserved. See. APNZ-6515

  • Fixed Raw Forwarding of Expect: 100-continue to the Backend​

Forwarding the client's Expect Continue expectation to the backend could cause an error, a hang, or a protocol issue. This header is no longer forwarded to the backend. See. APNZ-6509

  • Fixed False-Positive Application Log Errors for Successful DB-2-API Stored Procedure Calls​

A successful DB-2-API stored procedure call invoked through Try It could still be recorded as an Error in the Application Logs even when the call succeeded. Try It and API Proxy invocations of the same procedure now log consistently. See. APNZ-6086

  • Fixed Policies Disappearing After Deploy on Duplicated DB-2-API​

When a DB-2-API was duplicated, policies appeared on the duplicate screen but could vanish after deploy. The deploy flow now persistently retains policy definitions on the copied DB-2-API proxy. See. APNZ-6358

  • Fixed FAQ Entries Being Deleted When Edited in the Portal​

Editing an existing Portal FAQ entry and saving could wipe the record instead of updating it. The record is now updated correctly while preserving its portal association. APNZ-6095

  • Fixed Empty Accordion Boxes on Published Portal Pages​

HTML content pages using accordion-style boxes rendered correctly in the Manager's preview but showed empty boxes once published. Accordion contents on published pages now open reliably. APNZ-6182

  • Fixed Portal API Specification Examples Showing as Unreadable Text Instead of JSON​

Sample request and response bodies on Portal API specification pages appeared as unreadable raw text instead of valid JSON. Examples now display as proper JSON, matching what the Manager UI already showed. APNZ-6356, APNZ-6364

  • Fixed Portal Reporting and Dashboard Issues​

Several Portal Reports/Analytics issues were fixed: the API test console can be disabled with an explanatory message when a consumer has no subscription; the analytics dashboard no longer shows stale data after switching accounts; multi-select filters show the correct labels; and a cross-organization data leak was closed. APNZ-6432

  • Fixed Inaccurate WSDL Reparse Change-Preview for REST-to-SOAP-to-REST Proxies​

Reparsing a WSDL for a REST-to-SOAP-to-REST proxy compared the wrong pair of definitions and could report every endpoint as changed even when nothing had changed. The preview now compares only the client-facing contract and matches SOAP operations reliably across the transformation. See. APNZ-5956

  • Fixed Policy Drag-and-Drop Preview Showing Only Its Top Half​

When dragging a request/response/error policy button to reorder it in the API Proxy Flow screen, the drag preview box was visually cut off. The full policy box now appears under the cursor while dragging. See. APNZ-6056

  • Fixed Proxy Deploy Failure Caused by Deploy History Query​

Proxy deploy could fail because of deploy history. The issue was fixed so deploy completes reliably. APNZ-6300

  • Fixed Unsaved Promotion Mapping Being Created Automatically​

In API Promotion, after selecting a source API while creating a mapping, returning to the list without clicking Save could still show a mapping record even though the Save button was disabled. Mappings are now persisted only when Save is explicitly clicked. See. APNZ-6379

  • Fixed Inconsistent OAuth/JWT Client ID/Secret Edit and Regenerate Flow​

On OAuth/JWT policies, client id and client secret could not be edited on policy group, API Proxy Group, global policy, and proxy-group policy screens the same way as on the API Proxy page, and the Automatic/Manual regenerate flow was missing. All of these screens now match the API Proxy edit and regenerate behavior (Automatic / Manual key generation). See. APNZ-6398

  • Fixed JSON→XML and XML→JSON Transformations Being Silently Skipped​

In JSON and XML transformation policies, conversion could be skipped silently or leave the body in the wrong format. Transformation now runs correctly, and failures are no longer silent. See., See. APNZ-6484

uyarı

Behavior change — transformation failures are no longer silent. When a transformation fails on these policies, the request previously continued silently with the raw body and appeared successful. A policy error is now raised, and the outcome is governed by the policy's Error Message settings. The same change applies to Redaction and Business Rule policies that use a transformation action. Before upgrading, review whether you have a flow that runs these policies against bodies that cannot be transformed.

Output format change — JSON→XML root element. The root element name of JSON→XML output changed. Configurations that use "unwrap wrapper element" are unaffected; any downstream component (XSLT, parser, schema) written against the previous root element name must be updated.

Version 2026.04.0​

not

This is a major release that includes the migration of all platform components to Java 25, comprehensive security hardening, and numerous new features.

REMOVED FEATURES
  • Automatic deletion of audit logs and ACL audit logs via Purge Jobs has been removed. These logs are critical for compliance and should not be automatically deleted. Manual cleanup scripts are available in the database growth management documentation.
  • The option to disable database writing for audit and login logs in General Settings has been removed. These logs are now always persisted to the database.
FEATURED NEW FEATURES

  • Java 25 Migration​

All components of the Apinizer platform (API Manager, Gateway Worker, Cache Server, Integration, API Portal) have been upgraded to Java 25. Virtual thread support, modern JDK features, and performance improvements have been delivered. APNZ-5897

uyarı

Script Policy — javax → jakarta Auto-Migration: Starting with this version, Jakarta EE namespaces used in Groovy script policies (e.g. javax.servlet.*, javax.persistence.*, javax.xml.bind.*, javax.mail.*, etc.) are automatically converted to their jakarta.* equivalents before compilation. Existing scripts will be automatically migrated during the upgrade to this version. JDK standard library packages (javax.crypto.*, javax.net.ssl.*, javax.xml.parsers.*, javax.xml.transform.*, javax.script.*) are not affected by this conversion and will continue to work as-is.

  • Security Hardening​

Dependencies with known vulnerabilities identified during security scanning have been upgraded to their latest versions. Cross-Site Scripting (XSS), Insecure Direct Object References (IDOR), and Stack Trace Leak vulnerabilities have been resolved. innerHTML sanitization, endpoint-based project authorization checks, and prevention of technical detail leakage from error messages have been implemented. APNZ-5736, APNZ-5737, APNZ-5738

  • Full Elasticsearch 7, 8, and 9 Support​

The Elasticsearch client infrastructure has been restructured to fully support ES 7.x, 8.x, and 9.x versions. ILM, index templates, failover, and all analytics screens have been tested across all three versions. APNZ-5642, APNZ-5728, APNZ-5898

  • Message Builder Policy​

A new policy has been added that enables dynamic construction of request and response messages. Flexible message templates can be created with JEXL expression support, JSONPath, context variables, and conditional logic. See. APNZ-5783

  • Error Message Customization​

Return formats (JSON/XML) for error messages in policies can now be customized. Information about why each error type may occur has been added. Format selection is also available for undefined or unexpected errors. Repetitive and semantically similar error messages have been consolidated and simplified. See. APNZ-5798, APNZ-5940, APNZ-5888

  • API Promotion Module​

The API Promotion module has been added, enabling the transfer and management of API definitions across different environments. See. APNZ-5851

  • Advanced Logging Features​

An API Proxy-based log settings tab has been added. A log policy has been created. Metadata fields in log settings have been redesigned and descriptive warning messages have been added. See. APNZ-5942, APNZ-6033, APNZ-6020

NEW FEATURES
  • Default values for API Gateway routing, connection pool, retry, circuit breaker, health check, sticky session, gRPC, and WebSocket behaviors can now be centrally configured under System Settings. See
  • TCP Connectivity Test History records can now be automatically cleaned via Purge Jobs. Configure retention period in Application Log Cleanup Tasks settings.
  • Scheduled report sending has been added to Report Generator. Existing reports can now be selected and sent to connectors on a scheduled basis. See. APNZ-5914
  • JSON Schema Validation policy now supports automatic retrieval of schema information from the API's OpenAPI definition file. See. APNZ-5913
  • Querying API Proxy information via APIOps Management API is now supported. See. APNZ-5819
  • Environment Variable APIOps service has been added. Environment Variables can now be managed via APIOps. See. APNZ-5828
  • The ability to add cacert certificates to the API Manager JVM has been introduced. Certificates trusted by the API Manager can now be added from the management screen. See. APNZ-5831
  • The ability to upload keystores to API Manager has been added to the Keystore screen. See. APNZ-5909
  • SQL text search has been added to the DB2API screen. It is now possible to search which API a SQL query is used in. APNZ-4168
  • "Proxy Name" criteria has been added to the API Traffic Advanced Filter. Filtering by API Proxy name is now available on the general traffic screen. See. APNZ-4957
  • Dynamic TTL calculation from response has been added to the REST API Cache policy. See. APNZ-6005
  • Log policy has been added. See. APNZ-6033
  • An option to return undefined or unexpected errors in JSON or XML format has been added. See. APNZ-5940
  • TCP Connectivity Test screen has been added. TCP and TLS connection tests can now be performed from Gateway pods to target servers. See. APNZ-5960
  • Login audit records can now be sent to external systems via connectors. See. APNZ-4054
  • API Definition File Access Control has been added. Access to definition files such as WSDL and OpenAPI per API Proxy can now be restricted at three levels: open to everyone, authentication required, or completely hidden. APNZ-5944
CHANGES AND IMPROVEMENTS
  • Audit logs and login logs are now always saved to the database. The option to disable database writing for audit logs (audit_event), ACL audit logs (history_acl), and login logs in General Settings has been removed. Connector routing for these log types remains available as an optional feature.
  • Trace Screen Redesign: The API tracing (trace) screen has been redesigned. Policy durations, API Call details, and skip states can now be monitored visually. See. APNZ-3565
  • Library Updates: Spring Boot 3.5.x, Angular 19, PrimeNG 19, and numerous third-party dependencies have been updated.
  • Context and Global Environment Variable Expansions: The use of environment variables and context variables with $ has been expanded across API Call, Test Console, policies, and all configuration screens. See. APNZ-5776, APNZ-5788
  • mTLS Support in Test Console and API Call: SSL/TLS settings are now presented through a unified component across all screens. See. APNZ-5778
  • Environment Variable Support for Credentials: Environment-specific values can now be used in credential definitions. See. APNZ-5806
  • Show first error / show all errors option added to XML Schema Validation. See. APNZ-5887
  • Import Process Improvement: The "overwrite existing" option only takes the differences; a clean import adds the API Proxy as a new one. See. APNZ-5954
  • API Proxy Creation Routing UX Improvement: Routing addresses are displayed in table format and can be edited inline. See. APNZ-5955
  • Diff View in Deployment History: Differences from the previous version can now be visually compared. APNZ-5982
  • Time Management for JOSE Policies: Time management parameters have been added to JOSE Implementation and Validation policies. See. See. APNZ-5793
  • Request/Response Body Read Behavior: Performance improvements were made to the read behavior of incoming request and outgoing response bodies. APNZ-5935
  • System Properties Table: System properties can now be managed in a central table and default values can be retrieved from this table. See. APNZ-5919
  • Management API Improvements: APIOps endpoints have been expanded and improved. See. APNZ-5937
  • Various improvements have been made to the DB2API Creator screen. APNZ-3525
  • New search filters have been added to the API Proxy screen. APNZ-5422
  • API Proxy Group list can now be exported. APNZ-4493
  • A search field has been added to the Uptime Monitor list. APNZ-5197
  • Status code 200 is now selected by default in Uptime Monitor assertions. APNZ-4659
  • A policy delete option has been added to the Policy Actions menu. APNZ-4798
  • The "API Traffic By Interval" page can now also be viewed from within a project. See. APNZ-4986
  • Visual improvements have been made to the Clients with No Requests page. APNZ-4570
  • The API Manager environment has been added to the SSL environment selection. See. APNZ-5751
  • Automatic restart of pods when SSL is enabled in Remote Gateway environments has been prevented; a manual restart warning is now shown instead. See. APNZ-5853
  • Read timeout error message fix: Correct error classification instead of SSL Expired. APNZ-5957
  • Certificate sending support has been added to Test Console. See. APNZ-6019
  • PoolingHttpClientConnectionManager connection validation improvement has been made. APNZ-5835
  • Automatic propagation of Gateway access URL changes to the worker is now supported. See. APNZ-5838
  • API Portal LB Cache fix: Cache-Control and Last-Modified headers have been corrected. APNZ-5569
  • Validation UX improvement when adding multiple endpoints in no-spec APIs. APNZ-5702
  • "Showing X - Y of Z items" display in paginator has been corrected. APNZ-5927
  • SQL query formatting issue in the DB2API screen has been resolved. APNZ-5577
  • Image upload support has been added to API Portal. APNZ-5604
  • Error messages shown when a database connection is disabled have been improved. APNZ-5771
  • The design of metadata fields in log settings has been reviewed and warning messages have been added. See. APNZ-6020
BUG FIXES

Comprehensive stability, performance and usability improvements have been made across the platform. Fixes have been applied in many areas including policy management, API Portal, test console, routing, project management, audit logs, report screens and connection management.

  • Fixed XML Schema Validation race condition issue. APNZ-5787

  • Fixed SSE streaming connections being unexpectedly terminated and hop-by-hop HTTP headers not being filtered. APNZ-5868

  • Fixed template message corruption after REST-to-SOAP reparse. APNZ-5928

  • Fixed Manager UI freezing when attempting to add multiple proxies. APNZ-5686

  • Fixed issues with assigning the same relative path to multiple projects and relative path conflict handling. APNZ-5749, APNZ-5629

  • Elasticsearch deprecation warning logs have been resolved. APNZ-5646

  • Fixed TLS connection error in mail sending. APNZ-5811

  • Fixed the issue where principal information was not displayed in Audit Records after project deletion. APNZ-5830

  • Fixed analytics permission issue in the System Admin role. APNZ-5900

  • Fixed the issue where endpoint categories in API Proxies were not reflected in API Portal. APNZ-5863

  • Fixed issues with API Proxy duplication. APNZ-5917

  • Fixed null value returned when retrieving a private key using the Environment Private Key Map variable in scripts. APNZ-5924

  • Fixed the Enable Redirect feature working inversely in API Proxy connection settings. APNZ-5750

  • Fixed NTLM authentication not working in certain cases in routing. APNZ-5791

  • Fixed the issue where rollback to a previous deployment was not working. APNZ-5959

  • Fixed log search not working in certain cases in regions 1 and 2. APNZ-5951

  • Fixed Client-Ban feature not working. APNZ-5877

  • Fixed Report Generator not working in certain cases. APNZ-4076

  • Fixed the issue where login audit logs were not being recorded in certain cases. APNZ-4700

Version 2026.01.01​

Release Date: January 22, 2026

uyarı

Kubernetes environment types will be automatically assigned in this release: environments managed through Apinizer will be set as "Managed", others as "Remote".

FEATURED NEW FEATURES

  • API Manager Application Authorization System​

The authorization system in the Apinizer API Manager application has been renewed. Authorization now works based on the asset category + action model. Components with similar functions have been grouped under asset categories (API Management, Connections, Identity and Access Control, etc.) and specific actions (View, Manage, Deploy/Undeploy, Execute, Export/Import) have been defined for each category. This provides a more flexible, detailed, and secure authorization management. See.

  • Cache Server Definition in Namespace Independent from Gateway​

The requirement for worker pods that serve as the gateway function in the Apinizer application infrastructure and Hazelcast pods used for cache operations to be in the same namespace has been removed. Worker pods and cache pods can now be managed in separate namespaces. This provides a more flexible infrastructure configuration. See.

  • Multi-API Portal Support​

Support for managing multiple independent API Portals from a single Apinizer installation has been added. This enables offering customized portal experiences for different business units or customer groups. See.

  • Advanced Routing Features​

API Gateway routing capabilities have been enriched with Sticky Session (Session Affinity), Exponential Retry Delay, and Active Health Check mechanisms. This makes traffic management more flexible, resilient, and intelligent. See.

  • APIOps Management API Improvements​

In line with the vision that all administrative functions of Apinizer can be performed through APIOps Management APIs; full API support has been added for Credential Secrets management, Keys/Keystores operations, and JWK configurations. Additionally, the ability to create and update JWK from certificate, public key, private key, and keystore has been added. See.

NEW FEATURES

  • Upstream Sticky Session (Session Affinity)​

Sticky Session support has been added to ensure that clients are always routed to the same backend address. Session state management required for backend structures can now work efficiently through the Gateway with Cookie-based, IP Hash, and Hybrid methods. See.

  • Upstream Active Health Check Mechanism​

Active Health Check mechanism has been added that periodically checks the health status of backend services. Backend addresses that are not working correctly are automatically removed from traffic and reintroduced when they recover. See.

  • Upstream Exponential Retry Delay​

"Exponential Backoff" feature has been added that places increasing delays between retry operations performed in error situations. This provides the necessary time for backend services to recover under heavy load. See.

  • Environment Diagnostic Screen​

Diagnostic screen has been added to monitor the operational status, resource consumption, and health metrics of API Gateway environments. See. APNZ-5665, APNZ-5649

  • When certificate, public key, private key, or keystore is updated via APIOps Management API, if there is a related JWK, the ability to update these JWKs or delete the relationship has been added. See.
  • Feature has been added to globally enable/disable the display of log details on the API Traffic screen from General Settings. See.
  • Audit logs are now kept for operations involving API Proxy Traffic Log settings.
  • Search options with ends_with and wildcard have been added to FTP Read and List operations. See.
  • Client Route Report has been enhanced to find conflicting path values of API Proxies with similar relative path values.
  • API Portal Overview page has been enhanced. See.
  • Client data read timeout and no-request timeout after connection establishment have been made configurable in Gateway Runtime environments. These parameters allow customization of Gateway pod timeout behaviors. See.
CHANGES AND IMPROVEMENTS
  • URL Path Handling Improvement: The URL path processing mechanism in API Gateway has been improved to handle trailing slash values more consistently.
  • Elasticsearch Version Update: ES client version has been upgraded from 7.9.2 to 7.17.29; ES7 and ES8 versions are now fully supported.
  • Global Deploy Improvement: When global policies are updated, an option has been added to deploy only API Proxies that are already published in the relevant environment or all API Proxies. This prevents API Proxies that are not deployed from being accidentally deployed.
  • Asynchronous Operation Resource Management: Thread usage of tasks running asynchronously in Script and API Call policies has been limited, increasing system stability.
  • Detailed confirmation and warning that restart is required for changes to be applied have been added to the API Root Context change section in General Settings. See.
  • Load balancing is now always done locally (per pod). Distributed cache usage has been removed for performance. See.
  • Indication of disabled methods in API Proxy Group has been enabled. See.
  • Styling work has been done on large text areas in areas such as test console and data operations.
  • Detailed confirmation has been added for save&republish operation after entering host alias. See.
  • Visual design improvements have been made on the probe screen of the Kubernetes Resources page. See.
  • Monthly-daily reporting feature has been added to API Portal Usage Statistics.
  • Ability to download account information in Excel format from API Portal Accounts/Developers page has been enabled.
  • In export/import operations via APIOps Management API, "-imported" word is no longer added to DB2API definitions.
  • Customizable Landing Page feature has been added for API Portal. See.
  • In XML Schema Validation policy errors, related element and path information has been added to the error message.
  • Audit logs kept for operations performed with APIOps Management APIs have been detailed.
  • Error messages in API Manager LDAP settings have been made more detailed. More information is now provided in error messages to facilitate troubleshooting. See.
  • Timeout field has been added to LDAP connection configuration. Connection timeout durations are now configurable. See.
BUG FIXES

  • The issue where REST-2-SOAP example bodies were incorrectly created during the transfer of API Proxy Group spec to Postman has been fixed. APNZ-5695

  • The issue where Template Message comes empty in REST-2-SOAP-2-REST configurations has been resolved. APNZ-5694

  • Fixed inconsistency between OpenAPI spec output, Test Console template examples, and examples in spec imported to Postman for Rest-2-Soap-2-Rest services. APNZ-5664

  • Fixed JWT Authorization method-level authorization list not syncing after spec reparse or endpoint add/remove, and roles being lost when toggling Enable Role/Group Based Method Access. APNZ-5672

  • The issue where example request bodies (Example Request Body) for API Proxies could not be displayed in Test Console has been fixed. APNZ-5693

  • The issue where both API Proxy and Proxy Group access were blocked when direct gateway access was restricted has been fixed. APNZ-5687

  • The error in the Management API Access URL deletion operation in environment settings has been fixed. APNZ-5685

  • The issue where method information belonging to the wrong API Proxy was retrieved in the test console when there were multiple API Proxies created from the same DB2API, Mock API, or Script API has been fixed. APNZ-5684

  • The issue where data was not saved after pasting content in new key (Key) definitions in the Secret menu has been fixed. APNZ-5682

  • The issue where mandatory fields could be saved without being checked in API Portal settings has been prevented. APNZ-5659

  • The issue where the "Headers to be deleted" field in API Call policy was not saved has been fixed. APNZ-5650

  • The visual shift that occurred when searching for users on the Project Members page has been fixed. APNZ-5648

  • The memory (OutOfMemory) issue that occurred during parsing of very large Swagger/OpenAPI files containing more than 500 endpoints has been resolved. APNZ-5644

  • The listing issue that occurred on the gateway environments page when having limited kubernetes service permissions has been fixed. APNZ-5641

  • The issue where logo URL redirects in API Portal did not work and could not be customized has been fixed. APNZ-5593

  • Deficiencies related to user authorization and data security in API Portal have been resolved. APNZ-5581

  • The issue where the trailing ";" character was deleted in the DB2API SQL query field has been fixed. APNZ-5576

  • Thread safety improvement has been made in JSON library usage. APNZ-5571

  • Backward compatibility has been provided for the HTTP client class used in custom scripts. APNZ-5570

  • The issue where the SOAP binding name changed when the WSDL service address changed has been resolved. APNZ-5567

  • The issue where locked users in API Portal could perform operations through the gateway has been prevented. APNZ-5565

  • The issue where changes made in API Portal view settings were reset after login has been resolved. APNZ-5550

  • The issue where API Proxy traffic trace logs were stored longer than the configured duration has been fixed. APNZ-5535

  • The issue where API Proxy traffic trace mode did not automatically close has been fixed. APNZ-5509

  • The issue where a successful response was returned when a file was not found in FTP Read policy has been resolved. APNZ-5523

  • The issue where SOAP message header deletion was incomplete when the delete header setting was selected in WS-Security Sign Validation policy has been fixed. APNZ-5513

  • The issue where port settings were corrupted after SSL was enabled in gateway environments has been fixed. APNZ-5473

  • Filtering issues on the Notifications page have been fixed. APNZ-5454

  • The issue where API Proxies did not transition to redeploy status when policies were imported to API Proxies has been resolved. APNZ-5451

  • Old Proxy Group connections of exported/imported API Proxies have been cleaned up. APNZ-5447

  • The warning message displayed in environment type changes has been fixed. APNZ-5445

  • Mandatory field markings in WS-Security Sign policy have been fixed. APNZ-5435

  • Recording issues on the project edit page have been resolved. APNZ-5427

  • Character restrictions and validation errors in the key field entered in environment settings have been fixed. APNZ-5413

  • The issue where some policy names appeared in English in Turkish language selection has been fixed. APNZ-5375

  • The issue where spaces in the name field in authentication policies were not cleaned has been resolved. APNZ-5324

  • The issue where security check (captcha) did not appear when attempting to login with a non-existent user on the API Manager login page has been fixed. APNZ-5317

  • The saving issue in certificate updates has been resolved. APNZ-5211

  • The user display error on the Rate Limit screen has been fixed. APNZ-5166

  • The duplicate deployment issue in role definitions has been resolved. APNZ-5154

  • The performance issue in the environment republish operation has been resolved. APNZ-5120

  • Character errors in the endpoint address in the quick test tool have been fixed. APNZ-5116

  • URL formatting errors in test endpoints have been fixed. APNZ-4891

  • The issue where multiple selections were deleted on filtering pages has been resolved. APNZ-4674

  • Key listing issues in private key management in the Secret menu have been fixed. APNZ-4661

  • The data loss that occurred in Key Source selection in the Secret menu has been resolved. APNZ-4653

  • The operation type update error in API Call policy has been fixed. APNZ-4635

  • The issue where parameter type changes in the Design tab did not affect the format has been resolved. APNZ-4587

  • The pagination deficiency on some report pages has been resolved. APNZ-4579

  • The issue where timezone settings were not reflected in notification timestamps has been fixed. APNZ-4350

  • Image prefix issues in Kubernetes resource settings have been fixed. APNZ-4240

  • The issue where disabled methods in Proxy Group could not be displayed has been fixed. APNZ-4129

  • Conditional parameter usage in authentication policies has been improved. APNZ-4118

En son tarihinde güncellendi